CVE-2026-67174

Pivotick is affected by a DOM-based XSS in its generic UI element resolution and icon rendering utilities. The tryResolveHTMLElement function assigns resolved strings to a template via innerHTML, allowing untrusted graph properties or rendering callbacks to inject arbitrary HTML/SVG into the live...